Merge staging-next into staging

ci/OWNERS

@@ -128,6 +128,18 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 /nixos/modules/installer/cd-dvd/                @ElvishJerricco
 /nixos/modules/installer/sd-card/
 
+# Amazon
+/nixos/modules/virtualisation/amazon-init.nix     @arianvp
+/nixos/modules/virtualisation/ec2-data.nix        @arianvp
+/nixos/modules/virtualisation/amazon-options.nix  @arianvp
+/nixos/modules/virtualisation/amazon-image.nix    @arianvp
+/nixos/maintainers/scripts/ec2/                   @arianvp
+/nixos/modules/services/misc/amazon-ssm-agent.nix @arianvp
+/nixos/tests/amazon-ssm-agent.nix                 @arianvp
+/nixos/modules/system/boot/grow-partition.nix     @arianvp
+
+
+
 # Updaters
 ## update.nix
 /maintainers/scripts/update.nix   @jtojnar

nixos/modules/config/resolvconf.nix

@@ -145,6 +145,7 @@ in
         wants = [ "network-pre.target" ];
         wantedBy = [ "multi-user.target" ];
         restartTriggers = [ config.environment.etc."resolvconf.conf".source ];
+        serviceConfig.Type = "oneshot";
         serviceConfig.RemainAfterExit = true;
 
         script = ''

nixos/modules/module-list.nix

@@ -980,6 +980,7 @@
   ./services/networking/aria2.nix
   ./services/networking/asterisk.nix
   ./services/networking/atftpd.nix
+  ./services/networking/atticd.nix
   ./services/networking/autossh.nix
   ./services/networking/avahi-daemon.nix
   ./services/networking/babeld.nix

nixos/modules/services/networking/atticd.nix

@@ -0,0 +1,233 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  inherit (lib) types;
+
+  cfg = config.services.atticd;
+
+  format = pkgs.formats.toml { };
+
+  checkedConfigFile =
+    pkgs.runCommand "checked-attic-server.toml"
+      {
+        configFile = format.generate "server.toml" cfg.settings;
+      }
+      ''
+        export ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64="$(${lib.getExe pkgs.openssl} genrsa -traditional 4096 | ${pkgs.coreutils}/bin/base64 -w0)"
+        export ATTIC_SERVER_DATABASE_URL="sqlite://:memory:"
+        ${lib.getExe cfg.package} --mode check-config -f $configFile
+        cat <$configFile >$out
+      '';
+
+  atticadmShim = pkgs.writeShellScript "atticadm" ''
+    if [ -n "$ATTICADM_PWD" ]; then
+      cd "$ATTICADM_PWD"
+      if [ "$?" != "0" ]; then
+        >&2 echo "Warning: Failed to change directory to $ATTICADM_PWD"
+      fi
+    fi
+
+    exec ${cfg.package}/bin/atticadm -f ${checkedConfigFile} "$@"
+  '';
+
+  atticadmWrapper = pkgs.writeShellScriptBin "atticd-atticadm" ''
+    exec systemd-run \
+      --quiet \
+      --pipe \
+      --pty \
+      --same-dir \
+      --wait \
+      --collect \
+      --service-type=exec \
+      --property=EnvironmentFile=${cfg.environmentFile} \
+      --property=DynamicUser=yes \
+      --property=User=${cfg.user} \
+      --property=Environment=ATTICADM_PWD=$(pwd) \
+      --working-directory / \
+      -- \
+      ${atticadmShim} "$@"
+  '';
+
+  hasLocalPostgresDB =
+    let
+      url = cfg.settings.database.url or "";
+      localStrings = [
+        "localhost"
+        "127.0.0.1"
+        "/run/postgresql"
+      ];
+      hasLocalStrings = lib.any (lib.flip lib.hasInfix url) localStrings;
+    in
+    config.services.postgresql.enable && lib.hasPrefix "postgresql://" url && hasLocalStrings;
+in
+{
+  options = {
+    services.atticd = {
+      enable = lib.mkEnableOption "the atticd, the Nix Binary Cache server";
+
+      package = lib.mkPackageOption pkgs "attic-server" { };
+
+      environmentFile = lib.mkOption {
+        description = ''
+          Path to an EnvironmentFile containing required environment
+          variables:
+
+          - ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64: The base64-encoded RSA PEM PKCS1 of the
+            RS256 JWT secret. Generate it with `openssl genrsa -traditional 4096 | base64 -w0`.
+        '';
+        type = types.nullOr types.path;
+        default = null;
+      };
+
+      user = lib.mkOption {
+        description = ''
+          The group under which attic runs.
+        '';
+        type = types.str;
+        default = "atticd";
+      };
+
+      group = lib.mkOption {
+        description = ''
+          The user under which attic runs.
+        '';
+        type = types.str;
+        default = "atticd";
+      };
+
+      settings = lib.mkOption {
+        description = ''
+          Structured configurations of atticd.
+          See https://github.com/zhaofengli/attic/blob/main/server/src/config-template.toml
+        '';
+        type = format.type;
+        default = { };
+      };
+
+      mode = lib.mkOption {
+        description = ''
+          Mode in which to run the server.
+
+          'monolithic' runs all components, and is suitable for single-node deployments.
+
+          'api-server' runs only the API server, and is suitable for clustering.
+
+          'garbage-collector' only runs the garbage collector periodically.
+
+          A simple NixOS-based Attic deployment will typically have one 'monolithic' and any number of 'api-server' nodes.
+
+          There are several other supported modes that perform one-off operations, but these are the only ones that make sense to run via the NixOS module.
+        '';
+        type = lib.types.enum [
+          "monolithic"
+          "api-server"
+          "garbage-collector"
+        ];
+        default = "monolithic";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.environmentFile != null;
+        message = ''
+          <option>services.atticd.environmentFile</option> is not set.
+
+          Run `openssl genrsa -traditional 4096 | base64 -w0` and create a file with the following contents:
+
+          ATTIC_SERVER_TOKEN_RS256_SECRET="output from command"
+
+          Then, set `services.atticd.environmentFile` to the quoted absolute path of the file.
+        '';
+      }
+    ];
+
+    services.atticd.settings = {
+      chunking = lib.mkDefault {
+        nar-size-threshold = 65536;
+        min-size = 16384; # 16 KiB
+        avg-size = 65536; # 64 KiB
+        max-size = 262144; # 256 KiB
+      };
+
+      database.url = lib.mkDefault "sqlite:///var/lib/atticd/server.db?mode=rwc";
+
+      # "storage" is internally tagged
+      # if the user sets something the whole thing must be replaced
+      storage = lib.mkDefault {
+        type = "local";
+        path = "/var/lib/atticd/storage";
+      };
+    };
+
+    systemd.services.atticd = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ] ++ lib.optionals hasLocalPostgresDB [ "postgresql.service" ];
+      requires = lib.optionals hasLocalPostgresDB [ "postgresql.service" ];
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} -f ${checkedConfigFile} --mode ${cfg.mode}";
+        EnvironmentFile = cfg.environmentFile;
+        StateDirectory = "atticd"; # for usage with local storage and sqlite
+        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
+        Restart = "on-failure";
+        RestartSec = 10;
+
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = "";
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadWritePaths =
+          let
+            path = cfg.settings.storage.path;
+            isDefaultStateDirectory = path == "/var/lib/atticd" || lib.hasPrefix "/var/lib/atticd/" path;
+          in
+          lib.optionals (cfg.settings.storage.type or "" == "local" && !isDefaultStateDirectory) [ path ];
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@resources"
+          "~@privileged"
+        ];
+        UMask = "0077";
+      };
+    };
+
+    environment.systemPackages = [
+      atticadmWrapper
+    ];
+  };
+}

nixos/modules/services/networking/dhcpcd.nix

@@ -210,7 +210,8 @@ in
       { description = "DHCP Client";
 
         wantedBy = [ "multi-user.target" ] ++ lib.optional (!hasDefaultGatewaySet) "network-online.target";
-        wants = [ "network.target" ];
+        wants = [ "network.target"  "resolvconf.service" ];
+        after = [ "resolvconf.service" ];
         before = [ "network-online.target" ];
 
         restartTriggers = [ cfg.runHook ];

nixos/modules/virtualisation/ec2-data.nix

@@ -90,4 +90,6 @@ with lib;
       };
 
   };
+
+  meta.maintainers =  with maintainers; [ arianvp ];
 }

nixos/tests/all-tests.nix

@@ -136,6 +136,7 @@ in {
   artalk = handleTest ./artalk.nix {};
   atd = handleTest ./atd.nix {};
   atop = handleTest ./atop.nix {};
+  atticd = runTest ./atticd.nix;
   atuin = handleTest ./atuin.nix {};
   audiobookshelf = handleTest ./audiobookshelf.nix {};
   auth-mysql = handleTest ./auth-mysql.nix {};

nixos/tests/atticd.nix

@@ -0,0 +1,92 @@
+{ lib, pkgs, ... }:
+
+let
+  accessKey = "BKIKJAA5BMMU2RHO6IBB";
+  secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
+
+  minioCredentialsFile = pkgs.writeText "minio-credentials-full" ''
+    MINIO_ROOT_USER=${accessKey}
+    MINIO_ROOT_PASSWORD=${secretKey}
+  '';
+  environmentFile = pkgs.runCommand "atticd-env" { } ''
+    echo ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64="$(${lib.getExe pkgs.openssl} genrsa -traditional 4096 | ${pkgs.coreutils}/bin/base64 -w0)" > $out
+  '';
+in
+
+{
+  name = "atticd";
+
+  nodes = {
+    local = {
+      services.atticd = {
+        enable = true;
+
+        inherit environmentFile;
+      };
+
+      environment.systemPackages = [
+        pkgs.attic-client
+      ];
+    };
+
+    s3 = {
+      services.atticd = {
+        enable = true;
+        settings = {
+          storage = {
+            type = "s3";
+            bucket = "attic";
+            region = "us-east-1";
+            endpoint = "http://127.0.0.1:9000";
+
+            credentials = {
+              access_key_id = accessKey;
+              secret_access_key = secretKey;
+            };
+          };
+        };
+
+        inherit environmentFile;
+      };
+
+      services.minio = {
+        enable = true;
+        rootCredentialsFile = minioCredentialsFile;
+      };
+
+      environment.systemPackages = [
+        pkgs.attic-client
+        pkgs.minio-client
+      ];
+    };
+  };
+
+  testScript = # python
+    ''
+      start_all()
+
+      with subtest("local storage push"):
+          local.wait_for_unit("atticd.service")
+          token = local.succeed("atticd-atticadm make-token --sub stop --validity 1y --create-cache '*' --pull '*' --push '*' --delete '*' --configure-cache '*' --configure-cache-retention '*'").strip()
+
+          local.succeed(f"attic login local http://localhost:8080 {token}")
+          local.succeed("attic cache create test-cache")
+          local.succeed("attic push test-cache ${environmentFile}")
+
+      with subtest("s3 storage push"):
+          s3.wait_for_unit("atticd.service")
+          s3.wait_for_unit("minio.service")
+          s3.wait_for_open_port(9000)
+          s3.succeed(
+              "mc config host add minio "
+              + "http://localhost:9000 "
+              + "${accessKey} ${secretKey} --api s3v4",
+              "mc mb minio/attic",
+          )
+          token = s3.succeed("atticd-atticadm make-token --sub stop --validity 1y --create-cache '*' --pull '*' --push '*' --delete '*' --configure-cache '*' --configure-cache-retention '*'").strip()
+
+          s3.succeed(f"attic login s3 http://localhost:8080 {token}")
+          s3.succeed("attic cache create test-cache")
+          s3.succeed("attic push test-cache ${environmentFile}")
+    '';
+}

pkgs/applications/blockchains/clboss/default.nix

@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchFromGitHub
+, fetchzip
 , autoconf-archive
 , autoreconfHook
 , pkg-config
@@ -11,13 +11,12 @@
 
 stdenv.mkDerivation rec {
   pname = "clboss";
-  version = "0.13.3";
+  version = "0.14.0";
 
-  src = fetchFromGitHub {
+  # The release tarball includes the pre-generated file `commit_hash.h` that is required for building
-    owner = "ZmnSCPxj";
+  src = fetchzip {
-    repo = "clboss";
+    url = "https://github.com/ZmnSCPxj/clboss/releases/download/v${version}/clboss-v${version}.tar.gz";
-    rev = "v${version}";
+    hash = "sha256-Qp8br4ZxiqaxFZ6Tb+wFpqp2APmnU9QdNkM8MyGAtrw=";
-    hash = "sha256-T61rkTEGLCZrEBp1WFhHnQ7DQyhctMf5lgbOs6u9E0o=";
   };
 
   nativeBuildInputs = [ autoconf-archive autoreconfHook pkg-config libev curlWithGnuTls sqlite ];

pkgs/applications/misc/elogind/Add-missing-musl_missing.h-includes-for-basename.patch

@@ -0,0 +1,121 @@
+From ae7ecfc9487756659077e126bfd296146125a59d Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Sun, 13 Oct 2024 18:03:47 +0200
+Subject: [PATCH] Add missing musl_missing.h includes for basename
+
+Link: https://github.com/elogind/elogind/pull/292
+---
+ src/basic/cgroup-util.c                     | 1 +
+ src/libelogind/sd-bus/test-bus-watch-bind.c | 2 ++
+ src/login/logind-inhibit.c                  | 2 ++
+ src/login/logind-seat.c                     | 2 ++
+ src/login/logind-session.c                  | 1 +
+ src/test/test-fileio.c                      | 2 ++
+ src/test/test-mountpoint-util.c             | 1 +
+ src/test/test-path-util.c                   | 2 ++
+ 8 files changed, 13 insertions(+)
+
+diff --git a/src/basic/cgroup-util.c b/src/basic/cgroup-util.c
+index 90cfeb570..c57fe54d0 100644
+--- a/src/basic/cgroup-util.c
++++ b/src/basic/cgroup-util.c
+@@ -40,6 +40,7 @@
+ //#include "xattr-util.h"
+ /// Additional includes needed by elogind
+ #include "env-file.h"
++#include "musl_missing.h"
+ 
+ static int cg_enumerate_items(const char *controller, const char *path, FILE **ret, const char *item) {
+         _cleanup_free_ char *fs = NULL;
+diff --git a/src/libelogind/sd-bus/test-bus-watch-bind.c b/src/libelogind/sd-bus/test-bus-watch-bind.c
+index d6938a7f0..3227c17d7 100644
+--- a/src/libelogind/sd-bus/test-bus-watch-bind.c
++++ b/src/libelogind/sd-bus/test-bus-watch-bind.c
+@@ -17,6 +17,8 @@
+ #include "string-util.h"
+ #include "tmpfile-util.h"
+ #include "tests.h"
++/// Additional includes needed by elogind
++#include "musl_missing.h"
+ 
+ static int method_foobar(sd_bus_message *m, void *userdata, sd_bus_error *ret_error) {
+         log_info("Got Foobar() call.");
+diff --git a/src/login/logind-inhibit.c b/src/login/logind-inhibit.c
+index 86d1f84b3..4140f1aae 100644
+--- a/src/login/logind-inhibit.c
++++ b/src/login/logind-inhibit.c
+@@ -26,6 +26,8 @@
+ #include "string-util.h"
+ #include "tmpfile-util.h"
+ #include "user-util.h"
++/// Additional includes needed by elogind
++#include "musl_missing.h"
+ 
+ static void inhibitor_remove_fifo(Inhibitor *i);
+ 
+diff --git a/src/login/logind-seat.c b/src/login/logind-seat.c
+index bef542d94..f520562ad 100644
+--- a/src/login/logind-seat.c
++++ b/src/login/logind-seat.c
+@@ -24,6 +24,8 @@
+ #include "string-util.h"
+ #include "terminal-util.h"
+ #include "tmpfile-util.h"
++/// Additional includes needed by elogind
++#include "musl_missing.h"
+ 
+ int seat_new(Seat** ret, Manager *m, const char *id) {
+         _cleanup_(seat_freep) Seat *s = NULL;
+diff --git a/src/login/logind-session.c b/src/login/logind-session.c
+index ea69c2e6c..90ddec899 100644
+--- a/src/login/logind-session.c
++++ b/src/login/logind-session.c
+@@ -42,6 +42,7 @@
+ /// Additional includes needed by elogind
+ #include "cgroup-setup.h"
+ #include "extract-word.h"
++#include "musl_missing.h"
+ 
+ #define RELEASE_USEC (20*USEC_PER_SEC)
+ 
+diff --git a/src/test/test-fileio.c b/src/test/test-fileio.c
+index b9b82e7ff..db981bd41 100644
+--- a/src/test/test-fileio.c
++++ b/src/test/test-fileio.c
+@@ -25,6 +25,8 @@
+ #include "strv.h"
+ #include "tests.h"
+ #include "tmpfile-util.h"
++/// Additional includes needed by elogind
++#include "musl_missing.h"
+ 
+ #if 0 /// elogind does not need load_/write_/merge_env_file()
+ TEST(parse_env_file) {
+diff --git a/src/test/test-mountpoint-util.c b/src/test/test-mountpoint-util.c
+index de526100f..9d37ce77d 100644
+--- a/src/test/test-mountpoint-util.c
++++ b/src/test/test-mountpoint-util.c
+@@ -16,6 +16,7 @@
+ #include "string-util.h"
+ #include "tests.h"
+ /// Addition includes needed by elogind
++#include "musl_missing.h"
+ #include "virt.h"
+ #include "tmpfile-util.h"
+ 
+diff --git a/src/test/test-path-util.c b/src/test/test-path-util.c
+index 76fda746a..1df305d30 100644
+--- a/src/test/test-path-util.c
++++ b/src/test/test-path-util.c
+@@ -16,6 +16,8 @@
+ #include "strv.h"
+ #include "tests.h"
+ #include "tmpfile-util.h"
++/// Additional includes needed by elogind
++#include "musl_missing.h"
+ 
+ TEST(print_paths) {
+         log_info("DEFAULT_PATH=%s", DEFAULT_PATH);
+-- 
+2.46.0
+

pkgs/applications/misc/elogind/default.nix

@@ -79,11 +79,10 @@ stdenv.mkDerivation rec {
     (fetchpatch {
       url = "https://github.com/chimera-linux/cports/raw/49d65fe38be815b9918a15ac2d2ff2b123fc559a/main/elogind/patches/xxx-musl-fixes.patch";
       includes = [
-        "src/basic/cgroup-util.c"
         "src/basic/missing_prctl.h"
         "src/libelogind/sd-journal/journal-file.h"
       ];
-      hash = "sha256-kY+B1t87E/TtWa83r0VoiojhRrrB667ZhUAHtHE7m28=";
+      hash = "sha256-JYPB9AKbQpVgid5BhwBTvcebE5rxDFRMYhKRNS8KPTc=";
     })
     (fetchurl {
       url = "https://github.com/chimera-linux/cports/raw/49d65fe38be815b9918a15ac2d2ff2b123fc559a/main/elogind/patches/gshadow.patch";
@@ -111,7 +110,8 @@ stdenv.mkDerivation rec {
       url = "https://git.openembedded.org/openembedded-core/plain/meta/recipes-core/systemd/systemd/0021-shared-Do-not-use-malloc_info-on-musl.patch?id=6bc5e3f3cd882c81c972dbd27aacc1ce00e5e59a";
       hash = "sha256-ZyOCmM5LcwJ7mHiZr0lQjV4G+XMxjhsUm7g7L3OzDDM=";
     })
-    ./0001-Remove-outdated-musl-hack-in-rlimit_nofile_safe.patch
+    ./Add-missing-musl_missing.h-includes-for-basename.patch
+    ./Remove-outdated-musl-hack-in-rlimit_nofile_safe.patch
   ];
 
   # Inspired by the systemd `preConfigure`.

pkgs/applications/science/biology/stacks/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "stacks";
-  version = "2.66";
+  version = "2.68";
   src = fetchurl {
     url = "http://catchenlab.life.illinois.edu/stacks/source/${pname}-${version}.tar.gz";
-    sha256 = "sha256-9pHmcLYMdn9xy3vhlOU42Io/4L61auoncfpZNRPUN/I=";
+    sha256 = "sha256-ncUeo1bWDrRVewstGohUqvrkkq7Yf5dOAknMCapedlA=";
   };
 
   buildInputs = [ zlib ];

pkgs/applications/virtualization/docker/default.nix

@@ -323,9 +323,9 @@ rec {
   };
 
   docker_27 = callPackage dockerGen rec {
-    version = "27.3.0";
+    version = "27.3.1";
     cliRev = "v${version}";
-    cliHash = "sha256-1z2MmWq+HD2fhpZqXu0G7oBL3Mc0NN/fR69aMWRelns=";
+    cliHash = "sha256-Iurud1BwswGZCFgJ04/wl1U9AKcsXDmzFXLFCrjfc0Y=";
     mobyRev = "v${version}";
     mobyHash = "sha256-AKl06k2ePWOFhL3oH086HcLLYs2Da+wLOcGjGnQ0SXE=";
     runcRev = "v1.1.14";

pkgs/by-name/ar/arc-browser/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arc-browser";
-  version = "1.61.2-54148";
+  version = "1.63.1-54714";
 
   src = fetchurl {
     url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-y5oQFPdk6Y7AjzeTrA2U8MhGkPi6RJUcGqsvpjJ++UE=";
+    hash = "sha256-jL8iAh+e8Z72VG9XQbswjyTPtjO2Pm8ealRte8xr1PQ=";
   };
 
   nativeBuildInputs = [ undmg ];

pkgs/by-name/at/attic-client/package.nix

@@ -2,6 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , nix
+, nixosTests
 , boost
 , pkg-config
 , stdenv
@@ -53,7 +54,13 @@ rustPlatform.buildRustPackage {
     fi
   '';
 
-  passthru.updateScript = ./update.sh;
+  passthru = {
+    tests = {
+      inherit (nixosTests) atticd;
+    };
+
+    updateScript = ./update.sh;
+  };
 
   meta = with lib; {
     description = "Multi-tenant Nix Binary Cache";

pkgs/by-name/au/audiobookshelf/package.nix

@@ -6,6 +6,7 @@
   buildNpmPackage,
   nodejs_18,
   ffmpeg-full,
+  nunicode,
   util-linux,
   python3,
   getopt,
@@ -45,8 +46,7 @@ let
     inherit
       stdenv
       ffmpeg-full
-      pname
+      nunicode
-      nodejs
       getopt
       ;
   };

pkgs/by-name/au/audiobookshelf/source.json

@@ -1,9 +1,9 @@
 {
   "owner": "advplyr",
   "repo": "audiobookshelf",
-  "rev": "cf5598aeb9b086a28e853d6a89b82a7467fd6969",
+  "rev": "80e0cac4747e61d1fbb5374ec4ac41d3499042e2",
-  "hash": "sha256-tObC7QbdwpAlt97eXB9QzZEaQcquuST+8nC6lYEXTUM=",
+  "hash": "sha256-gwu9AvxrfW1QSgUy3Q4di1xa964ZMZpRkgdFQlit9+4=",
-  "version": "2.14.0",
+  "version": "2.15.0",
-  "depsHash": "sha256-nVsmV3Vms2S9oM7duFfgt+go1+wM2JniI8B3UFmv/TE=",
+  "depsHash": "sha256-TDZUrzVcmKn4izRn8E+uf6Mh22fRsHeVm5h+wRZAX8o=",
-  "clientDepsHash": "sha256-oaoGxcMs8XQVaRx8UO9NSThqbHuZsA4fm8OGlSiaKO0="
+  "clientDepsHash": "sha256-7R5+Yam9Y4+bj/8wrAE25g4sivg/sw5G0pAZFGPRpMI="
 }

pkgs/by-name/au/audiobookshelf/wrapper.nix

@@ -1,4 +1,9 @@
-{ stdenv, ffmpeg-full, pname, nodejs, getopt }: ''
+{
+  stdenv,
+  ffmpeg-full,
+  nunicode,
+  getopt,
+}: ''
     #!${stdenv.shell}
 
     port=8000
@@ -55,6 +60,7 @@
       SKIP_BINARIES_CHECK=1 \
       FFMPEG_PATH=${ffmpeg-full}/bin/ffmpeg \
       FFPROBE_PATH=${ffmpeg-full}/bin/ffprobe \
+      NUSQLITE3_PATH=${nunicode.sqlite}/lib/libnusqlite3 \
       CONFIG_PATH="$config" \
       METADATA_PATH="$metadata" \
       PORT="$port" \

pkgs/by-name/bu/buf/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.44.0";
+  version = "1.45.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     rev = "v${version}";
-    hash = "sha256-I0Y9gsNqCFLR2Bkt55HyER6wznTNoZW5345zUmuOFXQ=";
+    hash = "sha256-zmk9o0P4BaUqng9E/s6KKWntwS4NmTg/xPTrQruTQSo=";
   };
 
-  vendorHash = "sha256-4ykve9X//ckYPDkq76i0ojOiyzjrPJ/J2z7mA5giWKE=";
+  vendorHash = "sha256-NMrPBUwbDsXW8tc5l1Liqd19+v2RrXf6dlcwVnHxVXQ=";
 
   patches = [
     # Skip a test that requires networking to be available to work.

pkgs/by-name/ha/harper/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "elijah-potter";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-83Fg1oywYuvyc5aFeujH/g8Czi8r0wBUr1Bj6vwxNec=";
+    hash = "sha256-2Frt0vpCGnF3pZREY+ynPkdCLf2zsde49cEsNrqFUtY=";
   };
 
-  cargoHash = "sha256-Bt2KZ+m7VJXw4FYWt+ioo1XjZHNzbg/8fo8xrfEd6lI=";
+  cargoHash = "sha256-S3N9cn8Y4j5epvndvivgKyhjQQ5mNg89iSOlOx1Jmo0=";
 
   meta = {
     description = "Grammar Checker for Developers";

pkgs/by-name/ic/ice-bar/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "ice-bar";
-  version = "0.9.0";
+  version = "0.11.9";
 
   src = fetchurl {
     url = "https://github.com/jordanbaird/Ice/releases/download/${finalAttrs.version}/Ice.zip";
-    hash = "sha256-MvkJRP8Stz9VIK3vBnWezVKq2KkPfUa/NUBxJtYzHhU=";
+    hash = "sha256-nC7gIF4OdkUYoacbyr1cv5xpJkWDqhFW11UNZvgrQtE=";
   };
 
   sourceRoot = ".";

pkgs/by-name/kn/knxd/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "knxd";
-  version = "0.14.61";
+  version = "0.14.63";
 
   src = fetchFromGitHub {
     owner = "knxd";
     repo = "knxd";
     rev = finalAttrs.version;
-    hash = "sha256-b8svjGaxW8YqonhXewebDUitezKoMcZxcUFGd2EKZQ4=";
+    hash = "sha256-Ka4ATC20PS/yqHj+dbcIXxeqFYHDMKu6DvJWGd4rUMI=";
   };
 
   postPatch = ''

pkgs/by-name/le/legcord/package.nix

@@ -10,20 +10,20 @@
 }:
 stdenv.mkDerivation rec {
   pname = "legcord";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "Legcord";
     repo = "Legcord";
     rev = "v${version}";
-    hash = "sha256-/HwKxl3wiLSS7gmEQSddBkE2z1mmcexMgacUynLhdtg=";
+    hash = "sha256-R2mtE3L2cJgmbWT0aMoDbnM5tiyPk+dnPBedq8ro1lY=";
   };
 
   nativeBuildInputs = [ pnpm.configHook nodejs makeWrapper copyDesktopItems ];
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-e6plwWf5eFaGsP3/cvIkGTV1nbcw8VRM30E5rwVX1RI=";
+    hash = "sha256-UCErcNNGAVOe1CvbYc1OSwPQzXVM5tpUUtBpLXoaQdY=";
   };
 
   ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

pkgs/by-name/lo/localsend/package.nix

@@ -39,6 +39,11 @@ let
 
     buildInputs = [ libayatana-appindicator ];
 
+    postUnpack = ''
+      substituteInPlace $sourceRoot/linux/my_application.cc \
+        --replace-fail "gtk_widget_realize(GTK_WIDGET(window))" "gtk_widget_show(GTK_WIDGET(window))"
+    '';
+
     postInstall = ''
       for s in 32 128 256 512; do
         d=$out/share/icons/hicolor/''${s}x''${s}/apps

pkgs/by-name/mo/modprobed-db/package.nix

@@ -9,7 +9,7 @@
 }:
 let
   pname = "modprobed-db";
-  version = "2.47";
+  version = "2.48";
 in
 stdenv.mkDerivation {
   inherit pname version;
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     owner = "graysky2";
     repo = "modprobed-db";
     rev = "v${version}";
-    hash = "sha256-r/2ZENricRE03eyFnWDnfPNAz2863/9HKlF6a2xOkc0=";
+    hash = "sha256-rMkPBRg0QluMmSCAWSvET7rS/A2aUL6H31KKoZ6NTEs=";
   };
 
   strictDeps = true;

pkgs/by-name/ni/niri/package.nix

@@ -88,7 +88,7 @@ rustPlatform.buildRustPackage rec {
     ''
     + lib.optionalString withSystemd ''
       install -Dm0755 resources/niri-session -t $out/bin
-      install -Dm0644 resources/niri{-shutdown.target,.service} -t $out/share/systemd/user
+      install -Dm0644 resources/niri{-shutdown.target,.service} -t $out/lib/systemd/user
     '';
 
   env = {

pkgs/by-name/nu/nunicode/package.nix

@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  fetchFromBitbucket,
+  cmake,
+  sqlite,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nunicode";
+  version = "1.11";
+
+  outputs = [
+    "out"
+    "sqlite"
+  ];
+
+  src = fetchFromBitbucket {
+    owner = "alekseyt";
+    repo = "nunicode";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-6255YdX7eYSAj0EAE4RgX1m4XDNIF/Nc4ZCvXzTxpag=";
+  };
+
+  postPatch = ''
+    # load correct SQLite extension on all platforms
+    substituteInPlace sqlite3/testsuite --replace-fail \
+      "NU='./libnusqlite3.so'" \
+      "NU='./libnusqlite3'"
+
+    # fix expressions using like .. escape (https://sqlite.org/lang_expr.html#like)
+    substituteInPlace sqlite3/tests.sql --replace-fail '\\' '\'
+
+    # install SQLite extension in a separate output
+    echo >>sqlite3/CMakeLists.txt \
+      'install(TARGETS nusqlite3 DESTINATION "${placeholder "sqlite"}/lib")'
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    sqlite
+  ];
+
+  # avoid name-clash on case-insensitive filesystems
+  cmakeBuildDir = "build-dir";
+
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+
+    (
+    echo running SQLite testsuite
+
+    cd sqlite3
+    RESULT=$(../../sqlite3/testsuite < ../../sqlite3/tests.sql | sqlite3)
+    grep <<<$RESULT FAILED && echo SQLite testsuite failed && false
+
+    echo SQLite testsuite succeeded
+    )
+
+    runHook postCheck
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fast, small and portable Unicode library with SQLite extension";
+    homepage = "https://bitbucket.org/alekseyt/nunicode";
+    changelog = "https://bitbucket.org/alekseyt/nunicode/src/${finalAttrs.version}/CHANGELOG";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.mjoerg ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/nz/nzbget/package.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch2
 , cmake
 , boost
 , pkg-config
@@ -20,23 +19,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nzbget";
-  version = "24.2";
+  version = "24.3";
 
   src = fetchFromGitHub {
     owner = "nzbgetcom";
     repo = "nzbget";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+iJ5n/meBrMxKHSLxL5QJ7+TI0RMfAM5n/8dwYupGoU=";
+    hash = "sha256-Gci9bVjmewoEii6OiOuRpLgEBEKApmMmlA5v3OedCo4=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      # status page buffer overflow fix: https://github.com/nzbgetcom/nzbget/pull/346 -- remove when version > 24.2
-      url = "https://github.com/nzbgetcom/nzbget/commit/f89978f7479cbb0ff2f96c8632d9d2f31834e6c8.patch";
-      hash = "sha256-9K7PGzmoZ8cvEKBm5htfw5fr1GBSddNkDC/Vi4ngRto=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [

pkgs/by-name/pl/plex-desktop/package.nix

@@ -130,10 +130,7 @@ buildFHSEnv {
     substituteInPlace $out/share/applications/plex-desktop.desktop \
       --replace-fail \
       'Icon=''${SNAP}/meta/gui/icon.png' \
-      'Icon=${plex-desktop}/meta/gui/icon.png' \
+      'Icon=${plex-desktop}/meta/gui/icon.png'
-      --replace-fail \
-      'Exec=plex-desktop' \
-      'Exec=plex-desktop-${version}'
   '';
 
   runScript = writeShellScript "plex-desktop.sh" ''

pkgs/by-name/st/stats/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stats";
-  version = "2.11.11";
+  version = "2.11.14";
 
   src = fetchurl {
     url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-6USopfRy+ffxXYNAp14RcO/uKZa1yfnz2S3RP8HmCWw=";
+    hash = "sha256-JljFHlMcc8kfjGTdGAOP4ot+FqVy0yAJ1kxVO0TawHU=";
   };
 
   sourceRoot = ".";
@@ -22,8 +22,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/Applications
+    mkdir -p "$out/Applications"
-    cp -r *.app $out/Applications
+    cp -r *.app "$out/Applications"
 
     runHook postInstall
   '';
@@ -34,7 +34,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "macOS system monitor in your menu bar";
     homepage = "https://github.com/exelban/stats";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ donteatoreo emilytrau ];
+    maintainers = with lib.maintainers; [
+      donteatoreo
+      emilytrau
+    ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };

pkgs/by-name/wa/wakapi/package.nix

@@ -1,12 +1,12 @@
 {
   lib,
-  buildGo123Module,
+  buildGoModule,
   fetchFromGitHub,
 }:
 let
-  version = "2.12.0";
+  version = "2.12.1";
 in
-buildGo123Module {
+buildGoModule {
   pname = "wakapi";
   inherit version;
 
@@ -14,7 +14,7 @@ buildGo123Module {
     owner = "muety";
     repo = "wakapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-/aacT/VLA5S4PeGcxEGaCpgAw++b3VFD7T0CldZWcQI=";
+    hash = "sha256-+JxTszBa6rURm0vPy8Oke5/hX9EmDphWEp2eglS+SFU=";
   };
 
   vendorHash = "sha256-Q56Ud0MtkstB/dhn+QyAHTzIqHsmKvHEK+5PAt5lIMM=";

pkgs/data/fonts/junicode/default.nix

@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "junicode";
-  version = "2.208";
+  version = "2.209";
 
   src = fetchzip {
     url = "https://github.com/psb1558/Junicode-font/releases/download/v${version}/Junicode_${version}.zip";
-    hash = "sha256-uzPzZ6b/CxdcoXSsxf2Cfs9/MpcGn7pQfdwL37pbvXg=";
+    hash = "sha256-hdCDLwTiyE2ZpFgmYAX7YWCujUwozIozD+k/lCStJUg=";
   };
 
   outputs = [ "out" "doc" "tex" ];

pkgs/data/fonts/junicode/tex-font-path.patch

@@ -77,7 +77,7 @@ index c01ccaf..07a99ad 100644
  
  % DECLARE THE FONTS
  
--\setmainfont{Junicode VF}[
+-\setmainfont{JunicodeVF}[
 -    ItalicFont =         {*-Italic},
 -    BoldFont =           {*},
 -    BoldItalicFont =     {*-Italic},

pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix

@@ -92,13 +92,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "elementary-session-settings";
-  version = "8.0.0";
+  version = "8.0.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "session-settings";
     rev = version;
-    sha256 = "sha256-CtArMzM6eukH/Ob0W/U4xh2vvqm17m3T0w7lhcRid74=";
+    sha256 = "sha256-4B7lUjHEa4LdKrmsFCB3iFIsdVd/rgwmtQUAgAj3rXs=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/duckdb/versions.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.1",
+  "version": "1.1.2",
-  "rev": "af39bd0dcf66876e09ac2a7c3baa28fe1b301151",
+  "rev": "f680b7d08f56183391b581077d4baf589e1cc8bd",
-  "hash": "sha256-YPS3DqIYmFKXGkiQiU7/QKNNn7+YyavrA4uDenKuX2g="
+  "hash": "sha256-JoGGnlu2aioO6XbeUZDe23AHSBxciLSEKBWRedPuXjI="
 }

pkgs/development/libraries/libserialport/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libserialport";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchurl {
     url = "https://sigrok.org/download/source/libserialport/${pname}-${version}.tar.gz";
-    sha256 = "17ajlwgvyyrap8z7f16zcs59pksvncwbmd3mzf98wj7zqgczjaja";
+    sha256 = "sha256-XeuStcpywDR7B7eGhINQ3sotz9l1zmE7jg4dlHpLTKk=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/development/python-modules/bleak-retry-connector/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "bleak-retry-connector";
-  version = "3.5.0";
+  version = "3.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "bleak-retry-connector";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oqc997siTg43Ulrc539G3utfQvHjcBZJgQ8/CfcSduc=";
+    hash = "sha256-WjowXfj9kPlMmfs3aJBHIux5/w6te7zpXXqXPaz2pks=";
   };
 
   postPatch = ''

pkgs/development/python-modules/bleak/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "bleak";
-  version = "0.22.2";
+  version = "0.22.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "hbldh";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-O8EvF+saJ0UBZ8MESM5gIRmk2wbA4HUDADiVUtXzXrY=";
+    hash = "sha256-kPeKQcJETZE6+btQsmCgb37yRI2Klg0lZ1ZIrm8ODow=";
   };
 
   postPatch = ''

pkgs/development/python-modules/bluetooth-adapters/default.nix

@@ -10,6 +10,7 @@
   mac-vendor-lookup,
   myst-parser,
   poetry-core,
+  pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
   sphinx-rtd-theme,
@@ -20,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-adapters";
-  version = "0.19.4";
+  version = "0.20.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -29,7 +30,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "bluetooth-adapters";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XpPC7FVWzdEki6kdZDu0vV7iD1DZzGbI1f9VKxsjKUQ=";
+    hash = "sha256-dQjoaBK+WMHQss/7nQRRCE8Jv4S0iq6awa/t3SMGUiE=";
   };
 
   postPatch = ''
@@ -60,9 +61,12 @@ buildPythonPackage rec {
     usb-devices
   ];
 
-  pythonImportsCheck = [ "bluetooth_adapters" ];
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "bluetooth_adapters" ];
 
   meta = with lib; {
     description = "Tools to enumerate and find Bluetooth Adapters";

pkgs/development/python-modules/paddleocr/default.nix

@@ -14,7 +14,6 @@
   openpyxl,
   pdf2docx,
   pillow,
-  premailer,
   pyclipper,
   pymupdf,
   python-docx,
@@ -76,7 +75,6 @@ buildPythonPackage {
     openpyxl
     pdf2docx
     pillow
-    premailer
     pyclipper
     pymupdf
     python-docx

pkgs/development/python-modules/premailer/default.nix

@@ -1,43 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  isPy27,
-  cssselect,
-  cssutils,
-  lxml,
-  mock,
-  nose,
-  requests,
-  cachetools,
-}:
-
-buildPythonPackage rec {
-  pname = "premailer";
-  version = "3.10.0";
-  format = "setuptools";
-  disabled = isPy27; # no longer compatible with urllib
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "d1875a8411f5dc92b53ef9f193db6c0f879dc378d618e0ad292723e388bfe4c2";
-  };
-
-  buildInputs = [
-    mock
-    nose
-  ];
-  propagatedBuildInputs = [
-    cachetools
-    cssselect
-    cssutils
-    lxml
-    requests
-  ];
-
-  meta = {
-    description = "Turns CSS blocks into style attributes";
-    homepage = "https://github.com/peterbe/premailer";
-    license = lib.licenses.bsd3;
-  };
-}

pkgs/development/python-modules/publicsuffixlist/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "1.0.2.20241003";
+  version = "1.0.2.20241010";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YKLijjQ1xV4kQRIbaQhn8Hv/hl2Qv2YWcQrXoOOvnGE=";
+    hash = "sha256-pybYJrw7ZwSZXODKFE2HdoBg4Y4d855uV/LGRWccDfk=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/analysis/checkov/default.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.257";
+  version = "3.2.260";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-1uUKOIxv9p++p6t0O6RXn/cw3Py06mFxoCae0Bj75bU=";
+    hash = "sha256-Ltcb32p4mVjbRJB5Mjgu93oITOXHgEaNigMkd8a8rXw=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];

pkgs/development/tools/glamoroustoolkit/default.nix

@@ -28,23 +28,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glamoroustoolkit";
-  version = "1.1.2";
+  version = "1.1.4";
 
   src = fetchzip {
     url = "https://github.com/feenkcom/gtoolkit-vm/releases/download/v${finalAttrs.version}/GlamorousToolkit-x86_64-unknown-linux-gnu.zip";
     stripRoot = false;
-    hash = "sha256-C48zAKkkOIHe7ggjtjBVLbfCVRdY6BJGqdvTI/rCfns=";
+    hash = "sha256-/p/oCE1fmlPjy1Xg36rsczZ74L0M7qWsdcFm6cHPVVY=";
   };
 
   nativeBuildInputs = [
     wrapGAppsHook3
-    (patchelf.overrideAttrs (old: {
-      version = "0.11";
-      src = fetchurl {
-        url = "https://nixos.org/releases/patchelf/patchelf-0.11/patchelf-0.11.tar.bz2";
-        sha256 = "16ms3ijcihb88j3x6cl8cbvhia72afmfcphczb9cfwr0gbc22chx";
-      };
-    }))
   ];
 
   sourceRoot = ".";

pkgs/development/tools/gotemplate/default.nix

@@ -2,16 +2,20 @@
 
 buildGo123Module rec {
   pname = "gotemplate";
-  version = "3.9.1";
+  version = "3.9.2";
 
   src = fetchFromGitHub {
     owner = "coveooss";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-sRCyOQmj4ti+1Qdap0Q5MLoJZLwjZtw1cYjZMGksvuA=";
+    hash = "sha256-7FJejArGpnmkAzbN+2BOcewLdlcsh8QblOOZjFu+uSA=";
   };
 
-  vendorHash = "sha256-xtvexOmzTXjP3QsGp0aL3FdJe3mdBSCnTeM6hLq/tIo=";
+  vendorHash = "sha256-378oodyQG50l7qkTO5Ryt1NjFBbYW2n9by+ALNfTggI=";
+
+  # This is the value reported when running `gotemplate --version`,
+  # see https://github.com/coveooss/gotemplate/issues/262
+  ldflags = [ "-X main.version=${version}" ];
 
   meta = with lib; {
     description = "CLI for go text/template";

pkgs/development/tools/misc/lttng-tools/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lttng-tools";
-  version = "2.13.13";
+  version = "2.13.14";
 
   src = fetchurl {
     url = "https://lttng.org/files/lttng-tools/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-/19PALCB2sZgkq/o5yt8eQZwkxzxwe4N6qf4D7xTiD4=";
+    sha256 = "sha256-U733xK0H2/5mDuTZr/xj/kSuWemnPG96luD8oUDlrcs=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/development/tools/misc/terramate/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "terramate";
-  version = "0.10.7";
+  version = "0.10.8";
 
   src = fetchFromGitHub {
     owner = "terramate-io";
     repo = "terramate";
     rev = "v${version}";
-    hash = "sha256-CvvOJO57DotHpLB2FiAyYhF+WWXGuKEKCksnBWBiZ20=";
+    hash = "sha256-fT1yuFFHI88wUXKguWZD+PHU4j3w5eda7kzCDn+Gg+o=";
   };
 
   vendorHash = "sha256-kjzpXOoyTwjpYLBqDuB6Eup5Yzgej2U+HUo4z8V+cEI=";

pkgs/development/tools/qtcreator/default.nix

@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtcreator";
-  version = "14.0.1";
+  version = "14.0.2";
 
   src = fetchurl {
     url = "mirror://qt/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    hash = "sha256-lZXS5sZbuRjng3YxQ0HcK+9JHDIApcbVzm8wVQmwsos=";
+    hash = "sha256-stL4eLtpKKjm4w2HYAvdk89ATCYZoVHGS9zcjNB4OJI=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/ttfb/default.nix

@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ttfb";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-Cdup65w31wF1RZu0g4/msHfLESrNTcuCU5kxkk0gnW8=";
+    hash = "sha256-G5RSnh+S7gbIWJxm778pHN36xghpptcCpfElada0Afo=";
   };
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.Security
   ];
 
-  cargoHash = "sha256-U8CG0GqnUwya+ZK0qXtOFZ/MbbqSvB5egX7XJKtl88g=";
+  cargoHash = "sha256-kgfET2hOw0OAbBcKS7BOvY3nrLNX6CcQ6fOzVJ9rMOU=";
 
   # The bin feature activates all dependencies of the binary. Otherwise,
   # only the library is build.

pkgs/games/openrct2/default.nix

@@ -29,11 +29,11 @@
 }:
 
 let
-  openrct2-version = "0.4.14";
+  openrct2-version = "0.4.15";
 
   # Those versions MUST match the pinned versions within the CMakeLists.txt
   # file. The REPLAYS repository from the CMakeLists.txt is not necessary.
-  objects-version = "1.4.7";
+  objects-version = "1.4.8";
   openmsx-version = "1.6";
   opensfx-version = "1.0.5";
   title-sequences-version = "0.4.14";
@@ -42,14 +42,14 @@ let
     owner = "OpenRCT2";
     repo = "OpenRCT2";
     rev = "v${openrct2-version}";
-    hash = "sha256-d02LXcqoB6lDGdd82IrHi0Br8rjAFpRgQ86344XUeCA=";
+    hash = "sha256-VumjJGAur+2A7n0pFcNM7brYaoeaVCPBtRGFIZmq5QY=";
   };
 
   objects-src = fetchFromGitHub {
     owner = "OpenRCT2";
     repo = "objects";
     rev = "v${objects-version}";
-    hash = "sha256-XtKhgCahGzhuIdwvoz47rlRthZEhb0w+OuGhZnplHSc=";
+    hash = "sha256-A6iFaWda5qiFirGqOP6H9w0PP5Me8BRr2HXKZPHJImE=";
   };
 
   openmsx-src = fetchFromGitHub {

pkgs/os-specific/linux/kernel/xanmod-kernels.nix

@@ -7,12 +7,12 @@ let
   # kernel config in the xanmod version commit
   variants = {
     lts = {
-      version = "6.6.54";
+      version = "6.6.56";
-      hash = "sha256-i6Rm0Qasgxpw9XcK938IJ+qZ+V2z82zpuly2Au2J18Q=";
+      hash = "sha256-5EgCIMS6eZWPB8t6z6ts5sSHoeawja0diWuh/DNnvqw=";
     };
     main = {
-      version = "6.11.2";
+      version = "6.11.3";
-      hash = "sha256-4BXPZs8lp/O/JGWFIO/J1HyOjByaqWQ9O6/jx76TIDs=";
+      hash = "sha256-Pb/7XToBFZstI1DFgWg4a2HiRuSzA9rEsMBLb6fRvYc=";
     };
   };
 

pkgs/servers/mattermost/default.nix

@@ -12,13 +12,13 @@ buildGoModule rec {
   # See https://docs.mattermost.com/upgrade/extended-support-release.html
   # When a new ESR version is available (e.g. 8.1.x -> 9.5.x), update
   # the version regex in passthru.updateScript as well.
-  version = "9.5.9";
+  version = "9.5.10";
 
   src = fetchFromGitHub {
     owner = "mattermost";
     repo = "mattermost";
     rev = "v${version}";
-    hash = "sha256-mGTLn1aV6pB/ubqtYYF1zNRAaLj5IsdQTLhf1LzcNho=";
+    hash = "sha256-KUauFuRlOxBNNqE88pv5j0afEYQOZG6kWuyHnzg5qwQ=";
   };
 
   # Needed because buildGoModule does not support go workspaces yet.
@@ -34,14 +34,14 @@ buildGoModule rec {
 
   webapp = fetchurl {
     url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-    hash = "sha256-TgaRDIxGBoow1//99bGpp91HNYgdWRnoS09EDAFcHDs=";
+    hash = "sha256-psGNLmiT60HknrwESjztlr8NUPPnHsNmSTaRJ0RRqBE=";
   };
 
   # Makes nix-update-script pick up the fetchurl for the webapp.
   # https://github.com/Mic92/nix-update/blob/1.3.1/nix_update/eval.py#L179
   offlineCache = webapp;
 
-  vendorHash = "sha256-TJCtgNf56A1U0EbV5gXjTro+YudVBRWiSZoBC3nJxnE=";
+  vendorHash = "sha256-3IiW5ZAMX0bbN65iFgD2CH3BmXd1Uv2HgcCqY8VQgrA=";
 
   modRoot = "./server";
   preBuild = ''

pkgs/tools/networking/globalping-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "globalping-cli";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "jsdelivr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-/W/S+oG/3gD/+8mOWy4oWv7TR3IGKZt4cz0vE4nIzM4=";
+    hash = "sha256-MepnNbRX/smljiR9ysRWExFsfb7Qrz++7Y8S0Xn1Ax8=";
   };
 
   vendorHash = "sha256-V6DwV2KukFfFK0PK9MacoHH0sB5qNV315jn0T+4rhfA=";
@@ -18,6 +18,25 @@ buildGoModule rec {
   CGO_ENABLED = 0;
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
+  preCheck = ''
+    export HOME="$TMPDIR"
+  '';
+
+  checkFlags =
+    let
+      skippedTests = [
+        # Skip tests that require network access
+        "Test_Authorize"
+        "Test_TokenIntrospection"
+        "Test_Logout"
+        "Test_RevokeToken"
+        "Test_Limits"
+        "Test_CreateMeasurement"
+        "Test_GetMeasurement"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "|^" skippedTests}" ];
+
   postInstall = ''
     mv $out/bin/${pname} $out/bin/globalping
     installShellCompletion --cmd globalping \

pkgs/tools/package-management/opkg/default.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "opkg";
-  version = "0.6.3";
+  version = "0.7.0";
 
   src = fetchurl {
     url = "https://downloads.yoctoproject.org/releases/opkg/opkg-${version}.tar.gz";
-    hash = "sha256-85OONZZGtAbEDV1EKhRnx+cjV/kauCLkQml1KWQeBt4=";
+    hash = "sha256-2XP9DxVo9Y+H1q7NmqlePh9gIUpFzuJnBL+P51fFRWc=";
   };
 
   nativeBuildInputs = [

pkgs/tools/security/cdxgen/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdxgen";
-  version = "10.9.6";
+  version = "10.10.4";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cdxgen";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-WgY0soHwedYbQNDvDIqtaxMSzVcaOVV2/22wOXU2nbA=";
+    hash = "sha256-5FxH9cAJ9FoSn1euimKOvxlAEny+LUqj/EH80+l1v04=";
   };
 
   nativeBuildInputs = [
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-IgmTYmCmZ65Da5zL6Tx7P4bt2o+YhX0UvU0DEONmr7w=";
+    hash = "sha256-skgRkj6LrzRN5diQVbGU0KeJBklGWM6dksbr2njMDk0=";
   };
 
   buildPhase = ''

pkgs/top-level/python-aliases.nix

@@ -407,6 +407,7 @@ mapAliases ({
   postorius = throw "Please use pkgs.mailmanPackages.postorius"; # added 2022-04-29
   powerlineMemSegment = powerline-mem-segment; # added 2021-10-08
   prayer-times-calculator = prayer-times-calculator-offline; # added 2024-08-11
+  premailer = throw "premailer was removed, as it is not compatible with lxml>4.9.4.";
   privacyidea-ldap-proxy = throw "privacyidea-ldap-proxy has been removed from nixpkgs"; # added 2023-10-31
   proboscis = throw "proboscis has been removed since it has not been maintained for 11 years"; # added 2024-05-20
   prometheus_client = prometheus-client; # added 2021-06-10

pkgs/top-level/python-packages.nix

@@ -10656,8 +10656,6 @@ self: super: with self; {
 
   preggy = callPackage ../development/python-modules/preggy { };
 
-  premailer = callPackage ../development/python-modules/premailer { };
-
   preprocess-cancellation = callPackage ../development/python-modules/preprocess-cancellation { };
 
   preshed = callPackage ../development/python-modules/preshed { };